Tickets :: Comment on [#6748] Firefox 3 Web Based Protocol Handler support

* Your Email Address
* Spam protection	Enter the letters below: .__ .__ . ..__ .__. [ __[__)\|\/\|\| \[__] [_./\| \| \|\|__/\| \|
Comment	>> Add support for Firefox 3 web based protocol handlers: > >> http://developer.mozilla.org/en/docs/Web-based_protocol_handlers > > > > attached patch touches two files: > > > > 1) IMP.php function: getComposeArgs > > mailto URI refers to the message body as "body", not as "message". > > > > 2) The added HTML file registers the mailto handler for FF3 > > (has to be called from same domain as IMP, see mentioned FF3 docs) > > Keep the %26 for & in the handler URL! > > > > > > A security thought: I propose to strip CC and BCC from the mailto: > URL (i.e. don't copy them in getComposeArgs, if this function is not > used otherwise too), as these fields are not always shown in the > compose popup and the (normal) user would not expect these copies. > From RFC 2368 (The mailto URL scheme): > > > > 4. Unsafe headers > > The user agent interpreting a mailto URL SHOULD choose not to create > > a message if any of the headers are considered dangerous; it may also > > choose to create a message with only a subset of the headers given in > > the URL. Only the Subject, Keywords, and Body headers are believed > > to be both safe and useful. > > > > The creator of a mailto URL cannot expect the resolver of a URL to > > understand more than the "subject" and "body" headers. > > > > > > Martin
Attachment
Watch this ticket